Skip to content

[Security Solution] expandable flyout - fix topN opening with Raw Events instead of Detection Alerts + add missing interaction in cell actions#164923

Merged
PhilippeOberti merged 2 commits intomainfrom
expandable-flyout-cellactions
Aug 28, 2023
Merged

[Security Solution] expandable flyout - fix topN opening with Raw Events instead of Detection Alerts + add missing interaction in cell actions#164923
PhilippeOberti merged 2 commits intomainfrom
expandable-flyout-cellactions

Conversation

@PhilippeOberti
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti commented Aug 26, 2023 •
edited by kibanamachine
Loading

Summary

This PR aims at fixing a couple of behaviors related to cell actions in the new expandable flyout:

  • showTopN action now shows Detection Alerts by default instead of Raw Events for:
    • the severity and status components in the header
    • the highlighted field table
    • the alert reason preview
  • display more cell actions (we were the toggleColumInTable action) for:
    • the severity and status components in the header
    • the highlighted field table
      I couldn't have the toggleColumInTable action in the alert reason preview because the component we're using doesn't expose the option (the other instances of that component don't provide the option either...)
Screen.Recording.2023-08-26.at.6.46.47.PM.mov
Screen.Recording.2023-08-26.at.6.56.02.PM.mov

The following places could not be changed:

  • entities overview (user and host) in the right panel Insights section
  • entities details (user and hosts) in the left panel Insights section
    Because we're leveraging existing components. Changing those is feasible (I had a working POC) but seems very risky a couple of days before BC3, as it impacts other teams.
Screen.Recording.2023-08-26.at.6.47.14.PM.mov

Fixes #164801
Partially fixes #164553

Checklist

@PhilippeOberti PhilippeOberti requested a review from a team as a code owner August 26, 2023 17:11
This was referenced Aug 26, 2023
Closed
Closed
@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-cellactions branch from 1eade65 to 26fd26c Compare August 26, 2023 17:23
@PhilippeOberti PhilippeOberti added release_note:fix Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.10.0 labels Aug 26, 2023
@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-cellactions branch from 26fd26c to b8d58ff Compare August 26, 2023 17:47
christineweng
christineweng approved these changes Aug 26, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@christineweng christineweng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM. Thanks for updating the entities sections as well! Left a comment regarding the toggle column option.

I did some research on the host info and user info top n, they are still using the old hover actions. The new hover action uses sourcererScopeId, the older version still leverages scopeId. It seems the scopeId got lost in between components. I will check with explore to see whether they will use new hover actions everywhere soon, if not, will get a PR in 8.11

x-pack/plugins/security_solution/public/flyout/left/components/host_details.tsx Outdated
value: user,
}}
mode={CellActionsMode.HOVER_RIGHT}
triggerId={SecurityCellActionsTrigger.DETAILS_FLYOUT}
Copy link
Copy Markdown
Contributor

@christineweng christineweng Aug 26, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI - toggle column is not working due to this bug. Is it safer to revert back to default until it is fixed?

Copy link
Copy Markdown
Contributor Author

@PhilippeOberti PhilippeOberti Aug 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm divided, on one side I agree we should not show an option if it doesn't work, but on the other side the old flyout shows the option... Also the day we actually fix the source of the issue we would have to make sure to put it back everywhere...
I have a feeling that @paulewing will choose to not show the option, so I'm going to prepare a commit right now to remove it, and will merge once I have confirmation that's the behavior we want

Copy link
Copy Markdown
Contributor Author

@PhilippeOberti PhilippeOberti Aug 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@christineweng see newest commit

@PhilippeOberti
[Security Solution] expandable flyout - fix topN opening with Raw Eve…
ac30183 
…nts instead of Detection Alerts + add missing interaction in cell actions
@PhilippeOberti
revert DETAIL_FLYOUT to DEFAULT and 6 to 5 because of toggle column n…
0e97079 
…ot working on alerts table
@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-cellactions branch from b8d58ff to 0e97079 Compare August 28, 2023 12:35
@kibana-ci
Copy link
Copy Markdown

kibana-ci commented Aug 28, 2023

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 16.0MB 16.0MB +1.4KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@PhilippeOberti PhilippeOberti merged commit 94b947e into main Aug 28, 2023
@PhilippeOberti PhilippeOberti deleted the expandable-flyout-cellactions branch August 28, 2023 16:32
@kibanamachine kibanamachine mentioned this pull request Aug 28, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Aug 28, 2023
@PhilippeOberti
[Security Solution] expandable flyout - fix topN opening with Raw Eve…
ae778d3 
…nts instead of Detection Alerts + add missing interaction in cell actions (elastic#164923)

(cherry picked from commit 94b947e)
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Aug 28, 2023

💚 All backports created successfully

Status Branch Result
✅ 8.10

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Aug 28, 2023
@kibanamachine @PhilippeOberti
[8.10] [Security Solution] expandable flyout - fix topN opening with …
41e5dd0 
…Raw Events instead of Detection Alerts + add missing interaction in cell actions (#164923) (#165016)

# Backport

This will backport the following commits from `main` to `8.10`:
- [[Security Solution] expandable flyout - fix topN opening with Raw
Events instead of Detection Alerts + add missing interaction in cell
actions (#164923)](#164923)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Philippe
Oberti","email":"philippe.oberti@elastic.co"},"sourceCommit":{"committedDate":"2023-08-28T16:32:49Z","message":"[Security
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Threat
Hunting:Investigations","v8.10.0","v8.11.0"],"number":164923,"url":"https://github.com/elastic/kibana/pull/164923","mergeCommit":{"message":"[Security
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/164923","number":164923,"mergeCommit":{"message":"[Security
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6"}}]}]
BACKPORT-->

Co-authored-by: Philippe Oberti <philippe.oberti@elastic.co>
This was referenced Oct 1, 2023
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@christineweng christineweng christineweng approved these changes

Assignees

No one assigned

Labels

release_note:fix Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.10.0 v8.11.0

Projects

None yet

Milestone

No milestone

4 participants

@PhilippeOberti @kibana-ci @kibanamachine @christineweng